Symbian Worm Yxes: Towards Mobile Botnets?
Total Page：16
File Type：pdf, Size：1020Kb
J Comput Virol (2012) 8:117–131 DOI 10.1007/s11416-012-0163-2 ORIGINAL PAPER Symbian worm Yxes: towards mobile botnets? Axelle Apvrille Received: 20 December 2010 / Accepted: 3 April 2012 / Published online: 1 May 2012 © Springer-Verlag France 2012 Abstract In 2009, a new Symbian malware named the costs and inconveniences caused by the famous Comm- SymbOS/Yxes was detected and quickly hit the headlines Warrior worm, with 115,000 infected phones [14] and over as one of the first malware for Symbian OS 9 and above 450,000 messages [16] sent prove the matter cannot be under- all as the foretaste of a mobile botnet. Yet, detailed analy- estimated. sis of the malware were still missing. This paper addresses At the beginning of 2009, a new Symbian malware was this issue and details how the malware silently connects to detected [13]. It installed on recent and widely-deployed the Internet, installs new malware or spreads to other victims. Symbian OS 9 phones. The malware looked perfectly legiti- Each of these points are illustrated with commented assembly mate and there was no hint it might be a malware apart from code taken from the malware or re-generated Symbian API the fact it created no application icon. As it was typically con- calls. Besides those implementation aspects, the paper also nected to the word “sexy” (sexy.sisx as package name, “Sexy provides a global overview of Yxes’s behaviour. It explains View”, “Sexy Girls”, “Sexy Space” as application name etc), how malicious remote servers participate in the configuration Fortinet christened it Yxes, i.e. sexy from right to left. and propagation of the malware, including Yxes’s similari- The malware gained attention of anti-virus analysts ties with a botnet. It also tries to shed light on some incom- because it was reported to send out several SMS messages— plete or misleading statements in prior press articles. Those thus inflicting high bills to infected victims. Apart from a few statements are corrected, based on the reverse engineering more or less commercial spyware, it could also be seen as evidence previously. Finally, the paper concludes on Yxes’s the first malware for Symbian OS 9. Its ability to connect to importance and the lack of security on mobile phones. It also the Internet—a novelty in the history of mobile malware— indicates several aspects future work should focus on such also had analysts fear it might be part of a mobile botnet. as communication decryption, tools to analyze embedded With all those facts (high bills, Symbian OS 9, Internet, malware or cybercriminals motivations. botnet), no wonder it quickly made its way to IT headlines [9,11,18,39]. However, once the initial turmoil was over, only little 1 Introduction information or updates were published, and Yxes vanished out of memories... until new versions (variants E, F and G Malware for mobile phones is often regarded as a very in Fortinet’s naming convention) were again discovered, end rare disease, found in research labs by a few weird-looking of July 2009. Discussions about the new variants flourished techies. It is true that, with only 450 different mobile spe- on blogs and news for a couple of weeks and then disap- cies, they are clearly outnumbered by PC malware. The risks peared once more. As a consequence, at the time of writing have however proved not to be that insignificant because few this paper, there is barely any consistent and comprehensive mobile species does not mean few infections. For instance, study of the malware, detailing how it works and the new techniques it implements. This is what this paper wishes to A. Apvrille (B) address. Fortinet Technologies, EMEA AV Team, 120, rue Albert Caquot, 06410 Biot, France The paper is organized as follows. First, we briefly study e-mail: [email protected] Prior Art, grouping scattered information found on the net. 123 118 A. Apvrille Then, we provide some background information on Sym- • Highly specialized (and therefore incomplete) analysis: bian S60 3rd platforms and their alleged security. The next those articles are the most technically precise, but they sections detail the paper’s findings: Sect. 4 discusses the only explain part of the behaviour of the malware. For installation process of the malware, Sect. 5 details the main example, [8] is a serious academic paper which tries tasks of the malware. For a more comprehensive approach, to understand whether Yxes is part of a botnet or not. Sect. 6 provides a global overview of all actors involved in The paper however concludes—quite honestly as a mat- malware’s execution. Finally, based on the paper’s findings, ter of fact—that it was unable to reproduce the malware’s Sect. 7 tries to clarify incomplete or misleading information expected behaviour and thus cannot answer the botnet found in Prior Art. question. It is however interesting to read because the author explains how he analyzed the malware sample with forensic tools. [3] and [2] are other partial analy- 2 State of the art sis of Yxes: those previous work focus on specific points of Yxes: the Java Server Pages of the online servers ref- Compared to other research domains, the concern for mobile erenced by Yxes and the malware’s Symbian application malware is quite new as it does not date back longer than certificates. ten years. At first, only a few hackers such as [15] seemed to care for mobile phone security. In 2004, when the first The contribution of this paper is therefore twofold. mobile worm—named Cabir—started to spread, research on It explains how the malware is being reversed, describ- mobile malware gained public interest. A good overview of ing tools and tips which should be applicable—at least the status of mobile malware up to 2007 is presented in [16]. partially—to other Symbian S60 3rd malware. The other Those papers are interesting to read for background infor- contribution consists in filling in most gaps of detailed Yxes mation, but they do not discuss the reverse engineering of analysis, so as to provide a global understanding of how Yxes mobile code. works. Reverse engineering is a difficult art though, and a Papers in reverse engineering do exist. For instance, the few details remain in the shadows: those open questions are underground group 29A wrote a very technical description explicitly mentioned in the paper, so as not to mix them with of one of their Proof on Concept malware for WinCE [1]. For facts for which we have evidence. Symbian platforms, [25] is a must-read though it is written with the intent to crack applications, which is rather differ- 3 Background ent (technically and ethically) from virus analysis. On that aspect, [40] is probably more valuable to anti-virus analysts Most smart phones currently run an operating system named as it explains how to analyze what Symbian malware do. Symbian OS (47 % of market share Q4 2008 [38]). Yxes spe- Unfortunately, it discusses platforms older than Symbian OS cifically targets Symbian OS versions 9.1 or greater which 9, and consequently tools or tricks are seldom applicable to are the most recent and—according to—represent over 15 % newer mobile phones. More recent work such as [19]or[12] of market shares (with billions of handsets in the world, this cover interesting hacks for new phones (S60 3rd edition, but is huge). Actually, Symbian OS v9.1 is an important turn also iPhones or Android) but those presentations focus on in Symbian operating systems because it introduces several discovering vulnerabilities. They do not explain what tech- new features (please see [24,28] for more details): niques current mobile malware use nor how to understand what they are doing. 1. Data caging: applications are assigned a private direc- The only few articles dedicated to the specific case of Yxes tory where they may read/write their data. This directory fall in one of the following categories: cannot be accessed by other applications. Furthermore, there are a few restrictions on system directories. For • IT news articles [9,11,18,13,39]: they sometimes pro- example, applications may only write binaries to the sys vide a good overview of Yxes, but this paper will prove directory at installation time. details or implications are often approximate—or even 2. Capabilities: similarly to other operating systems such wrong (see Sect. 7). as Linux, applications must have the necessary rights to • Anti-virus encyclopedia descriptions [29,33,37]: they are perform specific actions like connecting to the Internet meant for anti-virus customers, from end-users to system or making a phone call. Those capabilities are granted administrators. Therefore, they explain how to recognize through mandatory code signing, i.e. developers must the virus, its impact and how to get rid of it. Thus, virus send their applications to a testing and certification pro- descriptions do not explain how viruses get their dirty gram called Symbian Signed and have them signed. work done (e.g. replicate, destroy...) nor how anti-virus 3. New compiler: platforms embed a new compiler, which analysts found information. supports ARM’s new Application Binary Interface 123 Symbian worm Yxes: towards mobile botnets? 119 (EABI). The downside for developers is that former application signed, or hacked a legitimate account. The applications no longer run on Symbian OS 9. Express Signed does include a few tests such as scanning 4. New installation file format: applications are packaged applications against viruses, but of course, at that time, using a new format which implements platform security the malware was undetected by all vendors, so there was measures.